Skip to main
University-wide Navigation

Methods other than an “in-person” consent discussion may be acceptable if those methods allow for an adequate exchange of information, a method to ensure that the signee of the consent form is the person who plans to enroll as a subject or is the legally authorized representative (LAR) of the subject, and, unless waived, documentation of consent where the subject or LAR signs and dates the document.

No single set of recommendations fits all research needs. Options vary with the risk level and applicable regulations. Also, consider what would be feasible or preferable for your subject population. You may want to propose multiple or contingency plans to meet situational or individual participant needs.

IRB Review

Your remote consent process must be prospectively reviewed and approved by the Institutional Review Board (IRB). Describe your plan(s) in the Research Description section (Informed Consent Process sub-section) of the E-IRB application.

Your consent plan should include:

  • how the consent form is presented/reviewed,
  • how signatures of the subject and/or LAR will be obtained,
  • how the name of the study personnel obtaining informed consent will be documented,
  • copies provided to subjects, and
  • if applicable, screenshots showing the final formatting and features the subjects would see.

Include your consent document(s) as an attachment to your E-IRB application in the Informed Consent section.

Process

The aim is to replicate the capabilities of an in-person consent process. General requirements regardless of the format include:

  • Provide the document to Participant/LAR in advance of the discussion
  • Conduct a process to allow for an adequate exchange of information, answer questions, and verify understanding
  • Provide the subject with time to consider and verify that consent is voluntary
  • Confirm that the signer of the consent form is the person who plans to enroll
  • Retrieve the signed document
  • Ensure the participant has a copy -  If warranted, you may add confidentiality protections to signed consents sent to the participant by email. See How to Send an Encrypted Email.
  • Ensure that the research staff receives the participant’s signed consent document before initiating study procedures

When live chat or video conferencing is used, investigators and study personnel should remind subjects to conduct the discussion in a private location to help ensure privacy and confidentiality. Document the conversation by noting:

  • The date,
  • Names of individuals present,
  • How the process was conducted,
  • Discussion points, and
  • How the signed document is to be returned.

If added security is needed or if HIPAA applies to the research, employ cybersecurity precautions or secure/HIPAA videoconferencing as applicable.

  • Standard UK Zoom also offers security options and encryption.
    • View Security under Settings for additional security steps, such as setting passcodes or requiring participants to authenticate prior to joining.
  • See Question 10 on the DHHS FAQs on Telehealth during COVID-19 for other “non-public facing” platforms that allow only the intended parties to participate in the videoconferencing. (Please note: Unacceptable public-facing products are also listed.)
  • UK Healthcare has a HIPAA-compliant contract with Zoom for secure videoconferencing.

Format

The Office for Human Research Protections (OHRP) and Food and Drug Administration (FDA) permit the flexibility of using electronic and paper-informed consent methods independently or in combination.

  • Paper Informed Consent Documents - If a paper document is used, mail, fax, or email the consent form, and if applicable, the HIPAA Authorization, to the potential subject and/or LAR in advance of the remote process.
  • Electronic Informed Consent – E-consent refers to the use of electronic systems and processes that may employ multiple electronic media, including text, graphics, audio, video, podcasts, passive and interactive websites, biological recognition devices, and card readers, to convey information related to the study and to obtain and document informed consent. For more information, see the E-consent webpage.

Research Conducted with a Waiver of Informed Consent Signatures

A waiver of informed consent signatures is available for select studies (i.e., telephone survey or mailed survey, internet research, or certain international research) if the research activities fit into one of three regulatory options:

  1. The only record linking the participant and the research would be the signed consent document, and the principal risk would be potential harm resulting from a breach of confidentiality (i.e., a study that involves participants who use illegal drugs).
  2. The research presents no more than minimal risk to the participant and involves no procedures for which written consent is normally required outside of the research context (i.e., a cover letter on a survey, or a phone script).
  3. The participant (or LAR) is a member of a distinct cultural group or community in which signing forms is not the norm, the research presents no more than minimal risk to the subject, and there is an appropriate alternative mechanism for documenting that informed consent was obtained.

Note: The IRB cannot waive the requirement for documentation or alter the consent form for research regulated by the FDA, unless it meets Option #2 – Minimal Risk Research

For more information, see the Waiver of Signatures webpage.

Paper Documents

  • Mail, fax, or email the consent form to the subject in advance.
    • E-mail: Information Technology Services (ITS) and HealthCare IT have enabled Data Loss Prevention (DLP) in Microsoft Office 365, a feature that will auto-encrypt certain email messages based on the information contained within them. You can trigger the feature by using the keyword “#secure” or “#encrypt” in the subject line. The recipient then receives instructions on how to open the message.
    • See How to Send an Encrypted Email or contact ITS Customer Services.
  • Once the potential subject has the form and you have verified correct individuals are connected by phone or video, talk through the consent, answer questions, and ensure the subject understands that consent is voluntary. You may document the conversation by noting the date, names of individuals present, how the process was conducted, discussion points, and whether the person agreed to enroll.
  • The subject may return the signed document electronically, via a prepaid envelope, or by scanning or photographing the signed and dated form and then sending it to the investigator by email/fax/upload, etc.
  • Document the study personnel who obtained consent by printing the name and date of consent obtained on the paper form.
  • Ensure the subject is provided with a copy of the form(s) he/she/they signed.

Electronic Consent

  • Electronic or E-consent refers to the use of electronic systems and processes that may employ multiple electronic media, including text, graphics, audio, video, podcasts, passive and interactive websites, biological recognition devices, and card readers, to convey information related to the study and to obtain and document informed consent.
    • To have a valid signature, your e-consent process should have:
      • the ability to prove that the actual signer is the intended signer;
      • the inability of the signer to deny the signature; and
      • an assurance that neither the record nor the signature has been altered since the moment of signing. To achieve this, the electronic signature and date should be linked to the document so that it cannot be modified or tampered with.
    • Having the individual type their name on a Word document or other format that allows the signature to be tampered with is not valid.
  • Ensure the subject is provided with a copy of the form(s) he/she/they signed.
    • E-consent may be formatted to include the printed name of the person obtaining consent, or the study personnel may print their name on the document when received.
  • Electronic Platforms (not FDA Part 11 compliant):
    • Qualtrics: HIPAA-compliant platform that includes options for providing subjects with a copy of the signed document.
    • REDCap: HIPAA-compliant electronic system that can be used to create your e-consent, verify identity, and collect signatures for research with automatic email of copies sent to both the subject and the investigator. REDCap is housed and maintained by CCTS.
  • Electronic Platforms for FDA-regulated research: Software systems must be compliant with all requirements under FDA Part 11 regulation (e.g., restricted access, administrative controls, training, identity verification, etc.).
    • FDA does not certify systems for Part 11 compliance.
    • Sponsors may provide Part 11-compliant electronic consent. You may request a statement from the sponsor or vendor of the electronic system used for obtaining the electronic signature that the system meets the relevant requirements contained in Part 11, and maintain documentation that your site has fulfilled applicable customer requirements, such as training, password controls, etc.   
    • For investigator-initiated research, refer to the Resource section below for Part 11 options, including DocuSign Part 11 and Adobe Sign Part 11.
    • Generally, there is no “out of the box” software solution as the customer is responsible for setting features, demonstrating compliance, providing/documenting training, and administering operational policies and procedures. This means your unit, department, or college has the responsibility to be able to demonstrate that the software is fit for its intended use and that the system meets the applicable regulations.
    • FDA Part 11 describes two types of signatures:
      • Electronic signature - a computer data compilation of any symbol(s) executed, adopted, or authorized by an individual to be a legally binding equivalent of the individual’s handwritten signature. Methods include computer-readable ID cards, biometrics, digital (cryptographic) signatures, and user/password combinations. Electronic signatures must comply with 21 CFR 11.5 & 11.7 signature requirements:
        • The printed name of the signer;
        • Date and time when the signature was executed;
        • Meaning (i.e., consent); and
        • Linked to their respective electronic records to ensure that they cannot be excised, copied, or otherwise transferred (i.e., tampered with).
    • Handwritten signatures executed to electronic records – hand-scripted signatures executed to electronic records by signing with a stylus, finger, or cursor drawing. These may be used in a hybrid process where the only electronic component is the documentation (signature) of informed consent. Handwritten signatures executed to electronic records must comply with 21 CFR 11.7:
      • Linked to their respective electronic records to ensure that they cannot be excised, copied, or otherwise transferred (i.e., tampered with).
  • Also see ORI Outline of FDA Guidance for Industry: Use of Electronic Informed Consent in Clinical Investigations.

Subject in Medical Isolation

The following process may be used when Electronic Informed Consent is not available or feasible:

  • A consent form and HIPAA Authorization, if applicable, are provided to the patient (or, if applicable, the LAR) by a health care worker who can enter the room.
  • If direct communication with the patient in isolation is not feasible or safe, the investigator obtains the patient’s phone number and arranges a three-way call or video conference with the patient, an impartial witness, and, if feasible, additional people as requested by the patient.
  • If the signed and dated paper consent document can safely be collected, the person who conducted the consent conference prints his/her/their name and enters the current date on the form, and provides the subject with a copy of the form(s) he/she/they signed.
  • If the signed informed consent document cannot be safely collected from the patient’s location and included in the study records, the FDA considers the following two options acceptable for providing documentation that the patient signed the informed consent document:
    • Method 1:
      • A photograph of the signed and dated document is transmitted to the investigator or research staff.
      • Place the photo of the signed consent in the subject’s study record along with an attestation that states how the photograph was obtained and that it is a photograph of the informed consent document signed by the patient. -OR-
    • Method 2:
      • Three-way communication with a witness who is not otherwise connected with the research and, if desired and feasible, additional individuals requested by the patient.
      • Alternatively, in lieu of using a witness, a recording of the conversation can be made and retained in the study record.
      • After reviewing the consent and answering all questions, obtain verbal confirmation from the patient that they would like to participate, and that they have signed and dated the consent document in their possession. Document the following in the study records:
        1. A signed and dated attestation by the witness who participated in the call, that the patient confirmed their agreement to participate and signed and dated the informed consent document (or call recording); and
        2. A signed and dated attestation by the investigator/designee stating why the informed consent document signed by the patient was not retained (e.g., contaminated).

Non-Public Facing Remote Communication

“A ‘non-public facing’ remote communication product is one that, as a default, allows only the intended parties to participate in the communication.  

Non-public facing remote communication products would include, for example, platforms such as Apple FaceTime, Facebook Messenger video chat, Google Hangouts video, Whatsapp video chat, Zoom, or Skype. Such products also would include commonly used texting applications such as Signal, Jabber, Facebook Messenger, Google Hangouts, Whatsapp, or 4 iMessage. Typically, these platforms employ end-to-end encryption, which allows only an individual and the person with whom the individual is communicating to see what is transmitted. The platforms also support individual user accounts, logins, and passcodes to help limit access and verify participants.  In addition, participants are able to assert some degree of control over particular capabilities, such as choosing to record or not record the communication or to mute or turn off the video or audio signal at any point. 

In contrast, public-facing products such as TikTok, Facebook Live, Twitch, or a public chat room are not acceptable forms of remote communication for telehealth because they are designed to be open to the public or allow wide or indiscriminate access to the communication. For example, a provider that uses Facebook Live to stream a presentation made available to all its patients about the risks of COVID-19 would not be considered reasonably private provision of telehealth services. A provider that chooses to host such a public-facing presentation would not be covered by the Notification and should not identify patients or offer individualized patient advice in such a livestream.” 

Cite: U.S. Department of Health and Human Services Office of Civil Rights, FAQs on Telehealth and HIPAA during the COVID-19 Nationwide Health Emergency (p.4-5)